@echo off

@set lst=
setlocal EnableDelayedExpansion
@for %%i in (.\logs\*.evtx) do (
	echo parsing %%i
	logParser -q:on -i:evt -o:csv  -oTsFormat yyyy/MM/dd_hh:mm:ss.000 "select TimeGenerated AS time, SourceName AS src, ComputerName as host, SID AS user, EventID AS action,'' as target, Message AS misc,'' AS tampered  FROM '%%i' where timegenerated > '2011-09-23 00:00:00' " > tmp.csv
	if not errorlevel 1 (
		set lst=!lst!,%%i
::		echo lst is !lst!
::		echo %%i is correct
	 )else move %%i .\logs\bak\
)

set lst=%lst:~1%
rem echo good list : %lst%

logParser -q:on -i:evt -o:csv -oTsFormat yyyy/MM/dd_hh:mm:ss.000 "select TimeGenerated AS time, SourceName AS src, ComputerName as host, SID AS user, EventID AS action,'' as target, Message AS misc,'' AS tampered FROM '.\logs\*.evtx' where timegenerated > '2011-09-23 00:00:00' "  >> ..\res.csv

:end